           (assoc-in [:jwt-claims "realm_access" "roles"]
                     ["akvo:lumen:t0"
                      "akvo:lumen:t0:admin"])
-          (assoc :tenant "t0")))
+          (assoc :tenant "t0")
+          update-auth-roles))
      200))
 
   (testing "GET admin resource as admin with claims and tenant"

(ns akvo.lumen.auth-test
  (:require [akvo.lumen.auth :as m]
            [clojure.test :refer [deftest testing is]]
            [ring.mock.request :as mock]))

(defn- test-handler

    (check-response
     ((wrap-auth test-handler)
      (-> (immutant-request :get "/api/resource")
          (assoc-in [:jwt-claims "realm_access" "roles"] ["akvo:lumen:t0"])
          update-auth-roles))
     403))

  (testing "GET resource with claims and tenant"
    (check-response
     ((wrap-auth test-handler)
      (-> (immutant-request :get "/api/resource")
          (assoc-in [:jwt-claims "realm_access" "roles"] ["akvo:lumen:t0"])
          (assoc :tenant "t0")
          update-auth-roles))
     200))

  (testing "GET resource as admin with claims and tenant"
